`containertool` should warn if the target executable is not compatible with the base layer

Accidentally building an image containing a mach-o binary stacked on top of a Linux base image causes confusing errors at runtime. The user may still have a good reason to put an incompatible file into an image, but `containertool` should at least print a warning if it detects it.

Start at the containertool entry point and trace how it identifies the target executable and base layer. Check how compatibility is determined for Mach-O and Linux binaries, then verify that an incompatible target produces a warning while the image build remains allowed.

Written by the indexing model from the issue text.